Henning Schulzrinne writes:
> The model seems a bit different depending on whether we're talking about
> basic/digest or PGP (or S/MIME) authentication.
>
> For basic/digest authentication, the gateway would have to know a user
> id and password registered with the remote UAS, appropriate for the
> realm "challenge". It's not likely that either a gateway or proxy will
> know what user names and passwords are valid at the callee UAS. (It is
> much more likely that a GUI-equipped SIP UAC will have this information,
> e.g., embedded in an address book or other cache, similar to how web
> browsers handle authentication.)
>
> For PGP or S/MIME, this is much more likely, as long as I can get
> something that is certified. Again, very similar to server
> authentication in a web case. In that model, the UAS would simply get
> "this call originated from a gateway that has the private key of
> Telephant Telephone Company." This would likely be good enough for me to
> judge whether this company will deal with crank calls appropriately and
> whether the caller id is more than a random bit string. (What you really
> want is probably something stronger, such as a way to find out whether
> this entity is certified in some way to have these properties, as the
> average callee is unlikely to recognize Granby Telephone, say.)
I guess I'm missing the huge difference
here. Both situations the UAC is somewhat
clueless about what credentials it needs
to ship for the URI. It can guess, and may
do a reasonable job at that, but it looks
fundamentally the same to me.
> Since the number of calls from a particular gateway to a particular UAS
> are likely going to be very low in most instances (I'd guess no more
> than ten a day), long-lived associations or caching aren't any more
> necessary than for S/MIME or PGP-secured email.
The caching may not be very important on the UAS.
It becomes more important the farther upstream
you go. It seems silly to always be shipping
credentials to my first hop proxy, for example,
when a far simpler keyed hash would do. The
trick for the UA's is to know when the
credential has been cached so that it can use
the faster method. This is trivial for the
first hop, but problematic at subsequent hops
since you don't exactly know how a particular
request URI will be routed until you try it.
Maybe there's some algorithmic ways of
accomplishing that, but I suspect that
heuristics may be easier to implement and
provide adequate results.
Mike
